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Practitioner's Docket No. NAI1P360/00.148.01 PATENT 
m THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re application of: Edwards et a! . 

Application No.: 09/823,438 Group No.: 2137 

Filed: 03/30/2001 Examiner: Michael Pyzocha 

For: VIRUS SCANNING PRIORITIZATION USING PRE-PROCESSOR CHECKING 

Mail Stop Appeal Briefs —Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

TRANSMITTAL OF APPEAL BRIEF 
(PATENT APPLICATION-37 CJF.R. § 1.192) 

L This brief is in furtherance of the Notice of Appeal filed October 13, 2005, which 
reinstates the appeal originally instated by the Notice of Appeal filed on April 28, 2005, and the 
original Appeal Brief filed June 28, 2005. 



2. STATUS OF APPLICANT 

This application is on behalf of other than a small entity. 



RECEIVED 
CENTRAL FAX CENTER 

OCT 1 4 2005 



CERTIFICATION UNDER 37 C.F.R. §§ 1.8(a) and 1.10* 

(When using Express Mail, the Express Mail label number is mandatory; 
Express Mail certification is optional) 

I hereby certify that, on the date shown below, this correspondence is being: 

MAILING 

_ deposited vrith the United Stales Postal Service in an envelope addressed to the Commissioner for Patents, P.O. Box 1450, Alexandria, Va 
22313-1450. 

37 CF.fc § \M*) 37 C.F.R. g 1.10* 

_ vrith sufficient postage as first dass mail. _ as "Express Mail Post Office to Addressee" 

Mailing Label No. (mandatory) 

✓ / TRANSMISSION 
_ facsimile transmitted to the Patent and Trademark Office, (703) 872^9306. 



Dote; 




(type or print name of person certifying) 



* Only the date of filing (' 1.6) will be the date used in a patent term aajaetment calculation, although the date on any cernficate of mailing or 
transmission under 9 1.8 continue* to be taken tnto account in determining tlwettness* See * 1.703 CO- Consider "Express Mail Post Office to 
Addressee " (* 1. 10) or facsimile transmission ( ' L6(d))fcr the reply to be accorded the earliest possible filing date for patent term adjustment 
calculations. 
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3* FEE FOR FILING APPEAL BRIEF 

Pursuant to 37 C.F.R § 1.17(c), the fee for filing the Appeal Brief has already been paid. 
However, the Commissioner is authorized to charge any fees that may be due to deposit account 50-1351 
(Order No. NAI1P360). 



4. EXTENSION OF TERM 

The proceedings herein are for a patent application and the provisions of 37 C.F.R. § 1.136 apply. 

Applicant believes that no extension of term is required. However, this conditional petition is 
being made to provide for the possibility that applicant has inadvertently overlooked the need for a 
petition and fee for extension of time. 

5. TOTAL FEE DUE 
The total fee due is: 

Appeal brief fee $0.00 (previously paid on June 28, 2005) 

Total Fee Due $0.00 



6. FEE PAYMENT 



Applicant believes that only the above fees are due in connection with the filing of this paper 
because the appeal brief fee was paid with a previous omission. However, the Commissioner is 
authorized to charge any additional fees that may be due (e.g. for any reason including, but not 
limited to fee changes, etc) to deposit account (Order No. NAI1P360). 

A duplicate of this transmittal is attached 

7. FEE DEFICIENCY 

If any additional extension and/or fee is required, and ifa^ddkTQrial fee for claims is required 
charge Deposit Account No. 50-135 1 (Order No. N/ 9 




Reg. No.: 41,429 
Tel. No.: 408-971-2573 
Customer No.: 28875 



Signature/of Prarationer 

Kevin J^ilka 

Zilka-Kotab, PC 

P.O, Box 721 120 

San Jose, CA 95 172-1 120 

USA 
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Practitioner's Docket No. NAHP360/00.1 48.01 PATENT 
IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re application of: Edwards et ai. 



copy 



Application No*: 09/823,438 Group No.: 2137 

Filed: 03/30/2001 Examiner: Michael Pyzocha 

For: VIRUS SCANNING PRIORITIZATION USING PREPROCESSOR CHECKING 

Moil Stop Appeal Briefs - Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

TRANSMITTAL OP APPEAL BRIEF 
(PATENT APPLICATION-37 C.FJR, § 1.192) 

1. This brief is in furtherance of the Notice of Appeal filed October 13, 2005, which 
reinstates the appeal originally instated by the Notice of Appeal filed on April 28, 2005, and the 
original Appeal Brief filed June 28, 2005. 

2. STATUS OF APPLICANT 

This application is on behalf of other than a small entity. 



CERTIFICATION UNDER 37 CF.R. §§ 1.8(a) and 1.10* 

(When using Express Mail, the Express Mail label number is mandatory; 
Express Mail certification is optional) 

1 hereby certify that, on the date shown below, this corresponded!*: is being: 

MAILING 

_ deposited with the United States Postal Service in an envelope addressed to the Commissioner for Patents. P.O. Box 1450. Alexandria, VA 
22313-1450, ^ 

37 CF-R. § 1 37 cjffc * 
_ with sufficient postage as first dws mail. _ as 'Express Mail Post Office to Addressee- 
Mailing Label No, (mandatory) 



. . TRANSMISSION 
C facsimile transmitted to the Patent and Trademark Office* (703) 872-9306. 




Date: 



(type or print name of person certifying) 

* Only the date of filing (> J .6) vill be the date used m a pawttte^ adjustment calculation, although the date onany certificate of mailing or 
tranwsionunder > K8 continues ta be taken into account tn determining timeliness. See • /. 703(f). Consider "£xpres$ Mail Post Office to 
Address" (> I.JO) or facsimile transmission f ' 1.6(d)) for the reply to be accorded the earliest possible filing daw for patent term adjustment 
calculations. 
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3. FEE FOR FILING APPEAL BRIEF 

Pursuant to 37 C.F.R. §1.1 7(c), the fee for filing the Appeal Brief has already been paid. 
However, the Commissioner is authorized to charge any fees that may be due to deposit account 50-1351 
(Order No. NAI1P360). 

4. EXTENSION OF TERM 

The proceedings herein are for a patent application and the provisions of 37 C.F.R. §1.136 apply. 

Applicant believes that no extension of term is required. However, this conditional petition is 
being made to provide for the possibility that applicant has inadvertently overlooked the need for a 
petition and fee for extension of time. 

5. TOTAL FEE DUE 
The total fee due is: 

Appeal brief fee $0.00 (previously paid on June 28, 2005) 

Total Fee Sue $0.00 

6. FEE PAYMENT 

Applicant believes that only the above fees are due in connection with the filing of this paper 
because the appeal brief fee was paid with a previous omission. However, the Commissioner is 
authorized to charge any additional fees that may be due (e.g. for any reason including, but not 
limited to fee changes, etc.) to deposit account (Order No. NAI1P360). 

A duplicate of this transmittal is attached. 

7. FEE DEFICIENCY 

If any additional extension and/or fee is required, and if^ddaTortaf fee for claims is required 
charge Deposit Account No. 50- 1 35 1 (Order No. N/ ' ^"^^ " equirea, 



Signature/of Prad£tfoner 
Reg. No.: 41,429 Kevin J^Zilka 

Tel. No.: 408-971-2573 Zilka-Kotab, PC 

Customer No.: 28875 p.o. Box 721 120 

San Jose, CA 95172-1 120 

USA 
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CENTRAL FAX CENTER 

0CT 1 4 2005 

PATENT 

IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 
In re application of: ) 
Edwards etal. ) Group Art Unit: 2137 

Application No. 09/823,438 ) Examiner: Pyzocha, Michael 

Filed: March 30, 2001 ) Date: October 14, 2005 

For: VIRUS SCANNING PRIORITIZATION) 
USING PRE-PROCESSOR CHECKING ) 
) 

Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 223 13-1450 

ATTENTION: Board of Patent Appeals and Interferences 

APPEAL BRIEF (37 C.F.R. § 41.37) 

This brief is in furtherance of the Notice of Appeal filed October 13, 2005, which 
reinstates the appeal originally instated by the Notice of Appeal filed on April 28, 
2005, and the original Appeal Brief filed June 28, 2005. 

The fees required under § 1 .17, and any required petition for extension of time for filing 
this brief and fees therefor, are dealt with in the accompanying TRANSMITTAL OF 
APPEAL BRIEF. 

This brief contains these items under the following headings, and in the order set forth 
below (37 CJF.R. § 41.37(c)(i)): 

I REAL PARTY IN INTEREST 

II RELATED APPEALS AND INTERFERENCES 
ffl STATUS OF CLAIMS 

IV STATUS OF AMENDMENTS 
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V SUMMARY OF CLAIMED SUBJECT MATTER 

VI ISSUES 

VII ARGUMENTS 

VIII APPENDIX OF CLAIMS INVOLVED IN THE APPEAL 

IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE APPELLANT 
IN THE APPEAL 

The final page of this brief bears the practitioner's signature. 
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I REAL PARTY IN INTEREST (37 C.F.R. § 41 J7(c)(l)(i)) 
The real party in interest in this appeal is McAfee, Inc. 
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II RELATED APPEALS AND INTERFERENCES (37 C.F.R. § 41.37(c) <1>(d» 

With respect to other prior or pending appeals, interferences, or related judicial 
proceedings that will directly affect, or be directly affected by, or have a bearing on the 
Board's decision in the pending appeal, there are no other such appeals, interferences, or 
related judicial proceedings. 

Since no such proceedings exist, no Related Proceedings Appendix is appended hereto. 
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IE STATUS OF CLAIMS (37 C.F.R. § 41.37(c) (l)(iii)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 

Claims in the application are: 1-5, 7-11, 17-23, 25-29, 35-41, 43-47 and 53-59 

B. STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . Claims withdrawn from consideration: None 

2. Claims pending: 1-5, 7-1 1, 17-23, 25-29, 35-41, 43-47 and 53-59 

3. Claims allowed: None 

4. Claims rejected: 1-5, 7-11, 17-23, 25-29, 35-41, 43-47 and 53-59 

C. CLAIMS ON APPEAL 

The claims on appeal are: 1-5, 7-11, 17-23, 25-29, 35-41, 43-47 and 53-59 
See additional status information in the Appendix of Claims. 
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IV STATUS OF AMENDMENTS (37 C.P.R. § 41.37(c)(l)(iv)) 

As to the status of any amendment filed subsequent to final rejection, there are no such 
amendments after final. 
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V SUMMARY OF CLAIMED SUBJECT MATTER (37 GFA. § 4L37(c)(l)(v)) 

With respect to a summary of Claim 1 et al.„ as shown in Figures 3 and 4, a method 
for prioritizing virus scan requests is provided including checking a virus scan 
request to determine if scanning an object of the request is necessary (e.g. item 320 
of Figure 3) and placing the virus scan request on a queue in a priority order based 
on a characteristic of the virus scan request (e,g. item 350 of Figure 3). The 
characteristic includes at least one of an identity of the user triggering the virus scan 
request, a type of the process accessing the object, a time stamp of when the virus 
request was received, and an indication of a network node accessing the object, 
wherein the virus scan request is prioritized ba$ed on at least one of the user identity 
being an administrator as compared to a regular user, the process type being an 
operating system as compared to a user appellant, the time stamp being earlier than 
the time stamps of each scan request previously placed on the queue, and the 
indication being that the object is accessed from a server console as compared to a 
network client (e.g. item 430 of Figure 3). Note page 13, line 9 - page 14, line 1 8 
and page 1 1, line 8 - page 12, line 6, for example. 

With respect to a summary of Claim 37 et al., the above summary is incorporated, at 
least in part, by reference. In addition, Figure 5 shows a virus scanner including a pre- 
processor thread that checks a virus scan request to determine if scanning an object of 
the request is necessary (e.g. item 320 of Figure 3) and a queue that receives the virus 
scan request in a priority order based on characteristics of the vims scan request, the 
characteristics including at least two of an identity of the user triggering the virus scan 
request, a type of the process accessing the object, a time stamp of when the virus scan 
request was received, and an indication of a network node accessing the object, wherein 
the virus scan request is prioritized based on at least two of the user identity being an 
administrator as compared to a regular user, the process type of being an operating 
system as compared to a user application, the time stamp being earlier than the time 
stamps of each scan request previously placed on the queue, and the indication being 
that the object is accessed from a server console as compared to a network client (e.g. 
items 530-550 of Figure 5). Note page 14, line 19-page 15, line 13, for example. 

-7- 
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With respect to a summary of Claim 55 et ah, the above summaries are incorporated, 
at least in part, by reference. In addition, Figure 6 shows a computer system is 
provided including a processor coupled to a system bus (e,g, item 605 of Figure 6), a 
memory coupled to the processor through the system bus (e.g. items 602-604 of 
Figure 6), a machine-accessible medium coupled to the processor through the 
system bus (e,g. items 621-627 of Figure 6), and a virus scanning process executed 
from the machine-accessible medium by the processor, wherein the virus scanning 
process causes the processor to check a vims scanning request to determine if 
scanning an object of the request is necessary, and if so to further place the checked 
virus scan request on a queue in a priority order based on characteristics of the virus 
scan request, the characteristics including each of an identity of the user triggering 
the virus scan request, a type of the process accessing the object, a time stamp of 
when the virus scan request was received, and an indication of a network node 
accessing the object, wherein the virus scan request is prioritized based on the user 
identity being an administrator as compared to a regular user, the process type being 
an operating system as compared to a user application, the time stamp being earlier 
than the time stamps of each scan request previously placed on the queue, and the 
indication being that the object is accessed from a server console as compared to a 
network client (e.g. item 430 of Figure 3), Note page 15, line 14 - page 17, line 18, 
for example. 
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VI ISSUES (37 CF.R. § 4L37(c)(l)(vi)) 

Following, under each issue listed, is a concise statement setting forth the corresponding 
ground of rejection. 

Issue # 1 : The Examiner has rejected Claims 1-1 1, 17, 1 9-23, 25-29 and 35 under 35 
U.S.C. 103(a) as being unpatentable over Chess et al„ U.S. Patent No. 6,560,632 in 
view of Wong, U.S. Patent No, 5,974,465. 

Issue # 2; The Examiner has rejected Claims 18 and 36 under 35 U.S.C. 103(a) as being 
unpatentable over Chess et aL, U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent 
No. 5,974,465, in further view of McAfee (webpage). 

Issue # 3: The Examiner has rejected Claims 37-41 and 43-53 under 35 U.S.C. 103(a) 
as being unpatentable over Chess et al., U.S. Patent No. 6,560,632 in view of Wong, 
U.S. Patent No. 5,974,465, in further view of "Reserved^Checkout for Versioned 
Object" IBM 1993. 

Issue # 4; The Examiner has rejected Claim 54 under 35 U.S.C. 103(a) as being 
unpatentable over Chess et al., U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent 
No. 5,974,465, in further view of "Reserved-Checkout for Versioned Object" IBM 
1993, in further view of McAfee (webpage). 

Issue # 5; The Examiner has rejected Claims 55-59 under 35 U.S.C. 103(a) as being 
unpatentable over Chess et al., U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent 
No. 5,974,465, in further view of "Reserved-Checkout for Versioned Object" IBM 
1993, in further view of "Chapter Thirteen Performance Tuning" (webpage), iti further 
view of Using Netware 3.12 (webpage). 
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VH ARGUMENTS (37 CF,R. § 41 J7(c)(l)(vii)) 



The claims of the groups noted below do not stand or fall together. In the present 
section, appellant explains why the claims of each group are believed to be separately 
patentable. 



Issue # 1: 



The Examiner has rejected Claims 1-1 1, 17, 19-23, 25-29 and 35 under 35 U.S.C. 
1 03(a) as being unpatentable over Chess et al„ U.S. Patent No. 6,560,632 in view of 
Wong, US. Patent No. 5,974,465. 



Group # I: Claims I 2, 5, 17, 19, 20, 23 and 35 



The Examiner has relied on the following excerpt from Chess to meet appellant's 
claimed: "checking a virus scan request to determine if scanning an object of the 
request is necessary; and placing the virus scan request on a queue in a priority order 
based on a characteristic of the virus scan request* ' (see Claim 1 and similar, but not 
identical, language in remaining independent claims). 



u The units of digital data preferably include queries or 
files. In one suck embodiment, the distributed system 
includes a computer protection system and the units of 
digital data include files or checksums of files which are 
suspected to contain malicious code. The malicious code may 
include computer viruses, worms or Trojan Horses. 

It is preferable that the prioritizing step comprises the 
steps of: classifying the queued queries or files into 
categories, clustering the files, in each of the categories, 
into similarity clusters; choosing, for each similarity 
cluster, one or more representatives; and determining an 
order of processing for the one or more representatives . The 
classifying step preferably includes the step of classifying 
the queued queries or files according to the type of digital 
object they contain," (col. 3, lines 42-$$) 



Appellant respectfully disagrees with this assertion. Specifically, Chess merely 
Suggests classifying queries or files already queued, for prioritized processing. In 
sharp contrast, appellant teaches and claims placing the virus scan requests on a 
queue in a priority order based on a characteristic of the virus scan request, for 



-10- 



PAGE 15/41 1 RCVDAT 10114/2005 11:10:13 AM [Eastern Daylight TimeJ * SVR:USPT0-EFXRF-K31 * DNIS:27383(K) * CSQ):40897146&0 2 DURATION (mnK$):08-18 



OCT. 14. 2005 8:22AM Z I L KA-KOTAB, PC 



NO. 0607 P. 16 



prioritized queuing. Thus, Chess's prioritization (as well as Wong's, for that matter) 
is specific to a classification process that occurs after queuing, while appellant's 
prioritization is specific to the queuing process itself during queuing. 

In the Advisory Action dated 4/19/2005, the Examiner has stated that Chess' 
rearranging of the queue is still placing requests in a prioritized order onto a queue 
and it is not claimed that this should be done during queuing. Appellant respectfully 
disagrees with such an assertion. Specifically, appellant claims "placing the virus 
scan request on a queue in a priority order. (emphasis added), and therefore 
clearly claims that the prioritizing is done during queuing. 

In the Office Action dated 8/5/2005, the Examiner has stated that "for Chess to 
prioritize the queries or files already queued they must be taken off of the queue and 
placed back on the queue in the correct priority order/' However, appellant notes 
that Chess does not teach prioritizing the queries or files already queued, as argued 
by the Examiner, but instead only teaches "determining an order of processing for 
the one or more representative." Thus, only the representative queries or files are 
prioritized. However, nowhere in Chess in there any disclosure that "the virus scan 
request [is placed] on a queue in a priority order based on a characteristic of the 
virus scan request " as claimed by appellant (emphasis added). 

In fact, Chess only teaches choosing representatives based on a characteristic of the 
file, such as a size of the file, a file that compresses the best, etc. (see Col. 7, lines 
41-59), Appellant respectfully asserts that choosing representative to be prioritized 
based on a characteristic of the file does not meet appellant's specific claim 
language, namely "placing the virus scan request on a queue in a priority order based 
on a characteristic of the virus scan request " (emphasis added). 

Furthermore, the Examiner has failed to meet appellant's claimed "checking a virus 
scan request to determine if scanning an object of the request is necessary." Again, 
appellant respectfully asserts feat Chess merely teaches selecting representatives for 
processing based on characteristics of the queries/files. However, Chess does not 
teach "checking a virus scan request" let alone doing so "to determine if scanning an 

-11- 
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object of the request is necessary. " as specifically claimed by appellant (emphasis 
added). 



Still yet, the Examiner has relied on the following excerpt from Wong to meet 
appellant's claimed; "the characteristic including at least one of an identity of the 
user triggering the virus scan request , . . wherein the virus scan request is prioritized 
based on at least one of the user identity being an administrator as compared to a 
regular user 5 ' (see Claim I and similar, but not identical, language in remaining 
independent claims). 



^Whenever an outbound packet is to be transmitted, 
prioritization software module 20$ examines that packet to 
determine whether it should be scored in queue 209 . The 
prioritization software module 2Q8 makes its determination 
based upon a particular configuration scheme. It is the 
function of software module 208 to initially configure the 
prioritization scheme. The configuration process entails 
specifying a number of different priority levels. For each of 
these priority levels, the software module 208 specifies a 
number of buffers within queue 209 which are to be reserved 
for that particular priority level. A buffer is a discrete 
unit of memory which is used to store one packet. The size of 
the packets and buffers can vary, depending on the hardware 
and software considerations." (col. 4, lines 14-41) 



Appellant respectfully disagrees with this assertion. Specifically, there is absolutely 
no mention in the foregoing excerpt, nor the remaining Wong reference, of any sort 
of placing virus scan requests in a queue based on a virus scan request characteristic 
including "an identity of the user triggering the virus scan request . , . wherein the 
virus scan request is prioritized based on at least one of the user identity being an 
administrator as compared to a regular user" (emphasis added), as claimed. 



In the Advisory Action dated 4/1 9/2005, the Examiner has stated that Col. 4, lines 
27-41 of Wong teaches different users where the user is sending the request 
Appellant respectfully asserts, however, that Wong teaches assigning priority based 
on input from either a user or network administrator. This clearly does not meet the 
specificity of appellant's claims, since such input does meet triggering a virus scan 
request as claimed. 
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In the Office Action dated 8/5/2005, the Examiner has merely reiterated his 
argument that "Wong teaches prioritization based on the identity of a user as seen in 
column 4, lines 14-41." Appellant again asserts that Wong merely teaches assigning 
priority based on types of applications or input from either a user or network 
administrator (see specifically Col. 4, lines 37-39), and does not teach placing virus 
scan requests in a queue based on a virus scan request characteristic" including "an 
identity of the user triggering the virus scan request . . . wherein the virus scan 
request is prioritized based on at least one of the user identity being an administrator 
as compared to a regular user" (emphasis added), as claimed. 

To establish & prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references 
themselves or in the knowledge generally available to one of ordinary skill in the art, 
to modify the reference or to combine reference teachings. Second, there must be a 
reasonable expectation of success. Finally, the prior art reference (or references 
when combined) must teach or suggest all the claim limitations. The teaching or 
suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. 
In re VaecWAl F,2d 488, 20 USPQ2d 1438 (Fed.Cir.1991), Appellant respectfully 
asserts that at least the first and third elements of the prima facie case of 
obviousness have not been met. 

Appellant thus respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, 
fail to teach or suggest all of the claim limitations, as noted above. 

Still yet, with respect to the first element of the prima facie case of obviousness, the 
Examiner states that it would have been obvious to one of ordinary skill in the art at 
the time of the invention was made to use Wong's method of prioritization to 
prioritize the requests of Chess et aL Appellant respectfully disagrees with this 
proposition, especially in view of the vast evidence to the contrary. 
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For example, Chess relates to a distributed security system, while Wong relates to a 
network data packet prioritization system. To simply glean features from a network 
data packet prioritization system* such as that of Wong, and combine the same with 
the non-analogous art of distributed se curity systems, such as that of Chess would 
simply be improper. A network data packet prioritization system prioritizes data 
packets via a network device, while a distributed security system detects viruses, etc. 
H In order to rely on a reference as a basis for rejection of an appellant's invention, 
the reference must either be in the field of appellant's endeavor or, if not, then be 
reasonably pertinent to the particular problem with which the inventor was 
concerned." In re Oetiker, 977 F.2d 1443, 1446, 24 USPQ2d 1443, 1445 (Fed. Cir, 
1992), See also In re Deminski, 796 F.2d 436, 230 USPQ 313 (Fed. Cir. 1986); In re 
Clay, 966 F.2d656, 659, 23 USPQ2d 1058, 1060-61 (Fed. Cir. 1992) In view of the 
vastly different types of problems a distributed security system addresses as opposed 
to a network data packet prioritization system, the Examiner's proposed combination 
is inappropriate. To simply dismiss appellant's unique application of prioritization 
techniques in the specific context of a security system would improperly frustrate 
the inventive concepts of appellant. 

In the Office Action dated 8/5/2005, the Examiner has argued that "[sjince Chess 
and Wong both relate to systems over a network they are analogous art." Appellant 
respectfully disagrees. Appellant again emphasizes that security systems, as in 
Chess, and packet prioritization systems, as in Wong, are not analogous, regardless 
of whether they are both systems that run over a network. The packet prioritization 
system of Wong simply transmits incoming and outgoing packets over a computer 
network according to a priority, whereas the security system of Chess detects 
unwanted data at nodes through which digital data flow. 

It appears that the Examiner has simply generalized his descriptions of the arts of 
Chess and Wong until they were analogous, to conveniently support his arguments. 
Of course, if generalized sufficiently, all arts can be found to be analogous in some 
capacity. 

Group # 2; Claims 3 and 21 
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The Examiner has relied on Col. 3, line 47-CoL 4, line 5 of Chess to make a prior art 
showing of appellant's claimed technique "wherein selecting is based on the priority 
order." Appellant respectfully asserts that the only "selecting" taught by the above 
excerpt simply relates to selecting 6< N smallest files in each cluster as the one or 
more representatives. . " Further, the only priority taught by Chess relates to 
prioritizing the representatives (see Col. 3, lines 52-53). Therefore, the actual 
selecting of files to be representatives cannot be prioritized since the prioritizing 
only happens once the representatives are selected (see Col. 4, line 1). 

In the Office Action dated 8/5/2005, the Examiner has argued that "[sjince [the 
packets] are placed on [the queue in] an order based on priority and characteristics, 
Chess discloses [appellant's] claimed limitations." Appellant again emphasizes that 
the only priority taught by Chess relates to prioritizing the representatives (see Col. 
3, lines 52-53) such that, when the files are selected from the queue to be 
representatives, they are not yet prioritized. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove, 

Group # J; Claims 4 T 9, 22 and 27 

The Examiner has relied on Col. 3, line 47-Col. 4, line 5 of Chess to make a prior art 
showing of appellant's claimed "wherein selecting is based on the characteristic of 
the virus scan request." Such excerpt however, merely teaches that "selecting N 
smallest files in each cluster as the one or more representatives. . There is simply 
no disclosure of any basis from which such files are selected, and therefore no 
disclosure of such basis being the "characteristic of the virus scan request" in the 
manner claimed by appellant. 

In the Office Action dated 8/5/2005, the Examiner has again argued that "[s]ince 
[the packets] are placed on [the queue in] an order based on priority and 
characteristics, Chess discloses [appellant's] claimed limitations." Appellant asserts 
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that the prioritization of representative files in Chess is based on characteristics of 
the file (see CoL 7, lines 41-59), and not "based on the characteristic of the virus 
scan request. " as claimed by appellant (emphasis added). 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 4: Claims 7, 8, 25 and 26 

The Examiner has relied on Col. 3, lines 48-64 of Chess to make a prior art showing 
of appellant's claimed technique "wherein the priority order is further based on 
comparing the characteristics of the virus scan request with the characteristics of the 
virus scan requests previously placed on the queue." Appellant respectfully asserts 
that such excerpt relied on by the Examiner simply discloses that files are clustered 
according to a code-similarity measure evaluated on a probably-malicious part of 
each file. Therefore, files that are presently in the queue are prioritized according to 
their code, and thus there is no teaching of "comparing the characteristics of the 
virus scan request with the characteristics of the virus scan requests previously 
placed on the queue," as claimed by appellant, 

In the Office Action dated 8/5/2005, the Examiner has simply reiterated his 
argument that "Chess teaches clustering and updating which correspond to the 
already on the queue and previously on the queue." Appellant respectfully asserts 
that nowhere in Chess is there any disclosure of "comparing the characteristics of 
the virus scan request with the characteristics of the virus scan requests previously 
placed on the queue," as claimed by appellant (emphasis added), Simply clustering 
files that were already placed on the queue and updating prioritizing information, as 
taught by Chess, does not even suggest utilizing any sort of characteristics of a virus 
scan request and especially not in the specific context claimed by appellant. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousne$$ has not been met, for the reasons set forth hereinabove. 
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Group # 5: Claims 10, 11, 28 and 29 

The Examiner has relied on Col. 4, lines 9-13 of Chess to make a prior art showing 
of appellant's claimed "wherein selecting is further based on comparing the 
characteristics of the virus scan requests placed in the queue with the characteristics 
of the previously selected virus scan requests whose objects are currently being 
scanned." Such excerpt, however, only discloses updating prioritization information 
based on identifying other queued files as being in the same cluster as a file that has 
been determined to be malicious. There is simply no disclosure of "objects currently 
being scanned," in the context claimed by appellant. 

In the Office Action dated 8/5/2005, the Examiner has again simply reiterated his 
argument that "Chess teaches clustering and updating which correspond to the 
already on the queue and previously on the queue.* Appellant again respectfully 
asserts that simply clustering files that were already placed on the queue and 
updating prioritizing information, as taught by Chess, does not even suggest 
utilizing any sort of characteristics of a vims scan request and especially not 
"comparing the characteristics of the virus scan requests placed in the queue with the 
characteristics of the previously selected virus scan requests whose objects are 
currently being scanned. 3 ' as claimed by appellant (emphasis added), 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Issue # 2: 

The Examiner has rejected Claims 18 and 36 under 35 U.S.C. 103(a) as being 
unpatentable over Chess et al., U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent 
No. 5,974,465, in further view of McAfee (webpage). 

Group # /; Claims 18 and 36 
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Such claims are deemed allowable for the reasons base Claim 1 is deemed 
allowable. 

Issue #3: 

The Examiner has rejected Claims 37-41 and 43-53 under 35 tLS-C. 103(a) as being 
unpatentable over Chess et al, U.S. Patent No, 6,560,632 in view of Wong, U.S. Patent 
No. 5,974,465, in further view of "Reserved-Checkout for Versioned Object" IBM 
1993. 

Group # I: Claims 37, 38, 41 and 53 

Such claims are deemed allowable for the reasons based Claim 1 is deemed 
allowable. 

In addition, the Examiner has relied on page 3 of IBM to meet appellant's claimed 
"characteristics including , . . a time stamp of when the virus request was received . . . 
wherein the virus scan request is prioritized based on . . . the time stamp being earlier 
than the time stamps of each scan request previously placed on the queue." 

Appellant respectfully asserts that IBM relates to checking out objects where 
reservations can be made to check out objects when such objects are already 
checked out. IBM simply does not teach placing a "checked virus scan request on a 
queue in a priority order based on. . . a time stamp of when the virus request was 
received," in the specific manner claimed by appellant (emphasis added), The only 
priority with respect to tirnestamps disclosed by IBM relates to reservations where a 
user with a reservation for an object with a highest priority (earliest timestamp) will 
have first priority in receiving the object over users with reservations with lower 
priority (later tirnestamps). Clearly, prioritizing reservations for objects, as in IBM, 
does not meet any sort of technique "wherein the virus scan request is prioritized 
based on . . . the time stamp being earlier than the time stamps of each scan request 
previously placed on the queue. " as specifically claimed by appellant (emphasis 
added). 
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Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons $et forth hereinabove. 

Group # 2: Claim 39 

The Examiner has relied on Col. 3, line 47-Col, 4, line 5 of Chess to make a prior art 
showing of appellants claimed technique 'Vherein the selection is based on the 
priority order." Appellant respectfully asserts that the only "selecting" taught by the 
above excerpt simply relates to selecting "N smallest files in each cluster as the one 
or more representatives..." Further, the only priority taught by Chess relates to 
prioritizing the representatives (see Col. 3, lines 52-53). Therefore, the actual 
selecting of fifes to be representatives cannot be prioritized since the prioritizing 
only happens once the representatives are selected (see Col. 4, line 1). 

In the Office Action dated 8/5/2005, the Examiner has argued that "[s]ince [the 
packets] are placed on [the queue in] an order based on priority and characteristics, 
Chess discloses [appellant's] claimed limitations." Appellant again emphasizes that 
the only priority taught by Chess relates to prioritizing the representatives (see CoL 
3, lines 52-53) such that, when the files are selected from the queue to be 
representatives, they are not yet prioritized. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 3: Claims 40 and 45 

The Examiner has relied on Col. 3, line 47-Col. 4, line 5 of Chess to make a prior art 
showing of appellant's claimed technique <4 wherein the selection is based on the 
characteristic of the virus scan request." Such excerpt however, merely teaches that 
"selecting N smallest files in each cluster as the one or more representatives. 
There is simply no disclosure of any basis from which such files are selected, and 
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therefore no disclosure of such basis being the "characteristic of Hie vims scan 
request," in the manner claimed by appellant. . 

In the Office Action dated 8/5/2005, the Examiner has again argued that "[s]ince 
[the packets] are placed on (the queue in] an order based on priority and 
characteristics, Chess discloses [appellant's] claimed limitations." Appellant asserts 
that the prioritization of representative files in Chess is based on characteristics of 
the file (see Col. 7, lines 41-59), and not "based on the characteristic of the virus 
scan request " as claimed by appellant (emphasis added). 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 4; Claims 43 and 44 

The Examiner has relied on Col. 3, lines 48-64 of Chess to make a prior art showing 
of appellants claimed technique "wherein the priority order is further based on 
comparing the characteristics of the virus scan request with the characteristics of the 
virus scan requests previously placed on the queue." Appellant respectfully asserts 
that such excerpt relied on by the Examiner simply discloses that files are clustered 
according to a code-similarity measure evaluated on a probably-malicious part of 
each file. Therefore, files that are presently in the queue are prioritized according to 
their code, and thus there is no teaching of "comparing the characteristics of the 
virus scan request with the characteristics of the virus scan requests previously 
placed on the queue," as claimed by appellant. 

In the Office Action dated 8/5/2005, the Examiner has simply reiterated his 
argument that "Chess teaches clustering and updating which correspond to the 
already on the queue and previously on the queue." Appellant respectfully asserts 
that nowhere in Chess is there any disclosure of "comparing the characteristics of 
the vims scan request with the characteristics of the virus scan requests previously 
placed on the queue," as claimed by appellant (emphasis added). Simply clustering 
files that were already placed on the queue and updating prioritizing information, as 
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in taught by Chess, does not even suggest utilizing any sort of characteristics of a 
virus scan request, and especially not with respect to any sort of comparison, in the 
specific context claimed by appellant* 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 5: Claims 46 and 47 

The Examiner has relied on Col. 4, lines 9-13 of Chess to make a prior art showing 
of appellant's claimed 'Svherein the selection is further based on comparing the 
characteristics of the virus scan requests placed in the queue with the characteristics 
of the previously selected virus scan requests whose objects are current fy being 
scanned." Such excerpt, however, only discloses updating prioritization information 
based on identifying other queued files as being in the same cluster as a file that has 
been determined to be malicious. There is simply no disclosure of "objects currently 
being scanned," in the context claimed by appellant 

In the Office Action dated 8/5/2005, the Examiner has again simply reiterated his 
argument that "Chess teaches clustering and updating which correspond to the 
already on the queue and previously on the queue.'* Appellant again respectfully 
asserts that simply clustering files that were already placed on the queue and 
updating prioritizing information, as taught by Chess, does not even suggest 
utilizing any sort of characteristics of a virus scan request, and especially not 
"comparing the characteristics of the virus scan requests placed in the queue with the 
characteristics of the previously selected virus scan requests whose objects are 
currently being scanned. " as claimed by appellant (emphasis added). 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Issue # 4: 
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The Examiner has rejected Claim 54 under 35 U.S.C. 103(a) as being unpatentable over 
Chess et al, U.S. Patent No. 6,560,632 in view of Wong, U.S. Patent No. 5,974,465, in 
further view of "Reserved-Checkout for Versioned Object" IBM 1993, in further view 
of McAfee (webpage). 

Group # 1: Claim 54 

Such claim is deemed allowable for the reasons base Claim 37 is deemed allowable. 
Issue # 5: 

The Examiner has rejected Claims 55-59 under 35 U.S.C. 103(a) as being unpatentable 
over Chess et al., U.S, Patent No. 6,560,632 in view of Wong, U.S. Patent No. 
5,974,465, in further view of "Reserved-Checkout for Versioned Object" IBM 1993, in 
further view of "Chapter Thirteen Performance Tuning" (webpage), in further view of 
Using Netware 3.12 (webpage). 

Group # /: Claims 55, 56, and 59 

Such claim is deemed allowable for the reasons Claim 1 is deemed allowable. 

In addition, the Examiner has relied on the following excerpts from Performance and 
NetWare to meet appellant's claimed 'the characteristic including .... a type of the 
process accessing the object, , , and an indication of a network node accessing the 
object, wherein the virus scan request is prioritized based on .... the process type 

being an operating system as compared to a user appellant and the indication 

being that the object is accessed from a server console as compared to a network 
client" (see Claim 55 and similar, but not identical, language in remaining 
independent claims). 
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Application Priority 

• 0-1 5; User-accessible process priorities 

o CMS; Low user range 
o 4: Low value 
c 7: Normal 

0 13; High value 

^ © 8-15: High user range 

♦ 16-31: System-accessible process priorities 

1 & aJSSftT" aCOe$Sil>le ,0 -ecu* 
« 25-31: Real-time value accessible to operating system only 

(see page 4 of Performance) 



SEND 



BROADCAST are treated as high-priori ZnT^Z^r^lZf^ WhCreas «« 

with SEND by using the CASTC^F canwsn^ sen * 



(see page 7 of Netware) 



The Examiner has also argued that "Performance teaches prioritization based on 
process types (see page 4) and Netware teaches prioritization based on network node 
type (see page 8)." Appellant respectfully disagrees with such assertion, as it 
appears that the Examiner has simply failed to consider the full weight of appellant's 
claims. 



Specifically, the Performance excerpt above simply foils to meet appellant's claimed 
"Characteristic including .... a type of the process accessing the object . . _ wherein the 
virus scan request is prioritized based on .... the process type being an operating 
system as compared to a user application" (emphasis added). As clearly set forth in 
the relevant excerpts hereinabove, Performance suggests processes that are 
accessible by user and system applications and foil short of a process that 
specifically accesses the object, as claimed, where one of the process types is an 
operation system process (note that a system application does not meet an operating 
system), 
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Further, the Netware excerpt above fails to meet appellant's claimed "characteristic 
including . , „an indication of a network node accessing the object wherein the virus 
scan request is prioritized based on ,„ the indication being that the object is accessed 
from a server console as compared to a network client ." Again, similar to the 
Performance reference, Netware does not meet appellant's claimed node that 
accesses the object as claimed, Instead Network merely suggests two types of 
messages, one sent using a SEND feature, and one sent using a BROADCAST 
feature. 

In the Advisory Action dated 4/19/05, the Examiner has stated that page 4 of 
Performance at 25-3 1 in the last part of the list teaches operating system processes, 
However, appellant respectfully asserts that the above excerpt does not teach "a type 
of process accessing the object" where the object is the hem that is requested to be 
scanned (see Claim 55). 

Also in the Advisory Action dated 4/19/05, the Examiner has stated that ''the SEND 
feature teaches the server console and the BROADCAST feature teaches a network 
client which make the requests " Appellant respectfully asserts that SEND, as in 
Netware, does not teach an indication of a network node accessing an object, as 
claimed, since it only relates to messages sent between workstations . In addition, 
BROADCAST, as in Netware, is simply a message sent by Netware to all users. 
Again, there is no accessing of an object, as claimed by appellant. In addition, even 
if receiving the message did indicate accessing an object, Netware would still not 
meet appellant's specific claim language since, in both the SEND and 
BROADCAST instances, a workstation (user) is receiving the message, and 
appellant claims the object being ''accessed from a server console as compared to a 
network client." 

In the Office Action dated 8/5/2005, the Examiner has stated that "Performance and 
Netware are only relied upon for their teachings of basing priority on 
characteristics... [and that] [w]hen applied to the prioritization system of the 
modified Chess we obtain the processes/nodes accessing the objects." Appellant 
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respectfully asserts that Chess only teaches prioritizing representative files based on 
characteristics of the files (see Col. 7, lines 41-49) and not characteristics of the 
virus scan request . Furthermore, the Performance and Netware references still fail 
to meet appellant's claimed "the characteristic including .... a type of the process 
accessing the object. . . and an indication of a network node accessing the object, 
wherein the virus scan request is prioritized based on .... the process type being an 

operating system as compared to a user appellant and the indication being that 

the object is accessed from a server console as compared to a network client," as 
argued above. Therefore, for the reasons argued above, the combination of the 
Chess, Performance, and Netware references do not make a prior art showing of 
appellant's specific claim language. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 2: Claim 57 

The Examiner has relied on Col. 3, line 47-Col. 4, line 5 of Chess to make a prior art 
showing of appellant's claimed *Svherein selecting is based on the priority order." 
Appellant respectfully asserts that the only "selecting" taught by the above excerpt 
simply relates to selecting <C N smallest files in each cluster as the one or more 
representatives. .." Further, the only priority taught by Chess relates to prioritizing 
the representatives (see Col. 3, lines 52-53). Therefore, the actual selecting of files 
to be representatives cannot be prioritized since the prioritizing only happens once 
the representatives are selected (see Col. 4, line 1), 

In the Office Action dated 8/5/2005, the Examiner has simply reiterated his 
argument that "Chess teaches clustering and updating which correspond to the 
already on the queue and previously on the queue." Appellant respectfully asserts 
that nowhere in Chess is there any disclosure of "comparing the characteristics of 
the virus scan request with the characteristics of the virus scan requests previously 
placed on the queued as claimed by appellant (emphasis added). Simply clustering 
files that were already placed on the queue and updating prioritizing information, as 
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in taught by Chess, does not even suggest utilizing any sort of characteristics of a 
virus scan request, and especially not in the specific context claimed by appellant. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

Group # 3: Claim 58 

The Examiner has relied on Col. 3, line 47-Col. 4, line 5 of Chess to make a prior art 
showing of appellant's claimed "wherein selecting is based on the characteristic of 
the virus scan request." Such excerpt however, merely teaches that "selecting N 
smallest files in each cluster as the one or more representatives. There is simply 
no disclosure of any basis from which such files are selected, and therefore no 
disclosure of such basis being the "characteristic of the vims scan request," in the 
manner claimed by appellant. 

In the Office Action dated 8/5/2005, the Examiner has simply reiterated his 
argument that "Chess teaches clustering and updating which correspond to the 
already on the queue and previously on the queue." Appellant respectfully asserts 
that nowhere in Chess is there any disclosure of "comparing the characteristics of 
the virus scan request with the characteristics of the virus scan requests previously 
placed on the queue," as claimed by appellant (emphasis added). Simply clustering 
files that were already placed on the queue and updating prioritizing information, as 
in taught by Chess, does not even suggest utilizing any sort of characteristics of a 
vims scan request and especially not in the specific context claimed by appellant. 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, for the reasons set forth hereinabove. 

In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along with any claims depending therefrom. 
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Vm APPENDIX OF CLAIMS (37 C.F.R. § 41.37(c)(l)(viif)) 

The text of the claims involved in the appeal (along with associated status information) 
is set forth below: 

1 . (Previously Presented) A method for prioritizing virus scan requests comprising; 

checking a virus scan request to determine if scanning an object of 
the request is necessary; and 

placing the virus scan request on a queue in a priority order based on 
a characteristic of the virus scan request, the characteristic including at least 
one of an identity of the user triggering the virus scan request, a type of the 
process accessing the object, a time stamp of when the virus request was 
received, and an indication of a network node accessing the object, wherein 
the virus scan request is prioritized based on at least one of the user identity 
being an administrator as compared to a regular user, the process type being 
an operating system as compared to a user appellant, the time stamp being 
earlier than the time stamps of each scan request previously placed on the 
queue, and the indication being that the object is accessed from a server 
console as compared to a network client, 

2. (Original) The method of claim 1, further comprising; 

selecting a one of the virus scan requests from the queue. 

3. (Original) The method of claim 2, wherein selecting is based on the priority 
order, 

4. (Original) The method of claim 2, wherein selecting is based on the 
characteristic of the virus scan request. 

5. (Original) The method of claim 2, further comprising: 

scanning the object of the selected virus scan request. 

6. (Cancelled) 
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7. (Original) The method of claim 1, wherein the priority order is further based on 
comparing the characteristic of the virus scan request with the characteristics of 
the virus scan requests previously placed on the queue. 

8. (Original) The method of claim 7, wherein the priority order is further based on a 
parameter indicating which of the compared characteristics is given higher 
priority. 

9. (Original) The method of claim 4, wherein selecting is further based on 
comparing the characteristics of the virus scan requests placed in the queue. 

10. (Original) The method of claim 9, wherein selecting is further based on 
comparing the characteristics of the virus scan requests placed in the queue with 
the characteristics of the previously selected virus scan requests whose objects 
are currently being scanned. 

1 1. (Original) The method of claim 10, wherein selecting is further based on a 
parameter indicating which of the compared characteristics is given higher 
priority, 

12. (Cancelled) 

13. (Cancelled) 

14. (Cancelled) 

15. (Cancelled) 

16. (Cancelled) 

17. (Original) The method of claim 1, wherein scanning is necessary when a virus 
scan status indicates the object is not known to be virus free. 
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1 8. (Original) The method of claim 1, wherein scanning is necessary when the object 
of the virus scan request is in a directory not excluded from virus scanning. 

19. (Previously Presented) An apparatus comprising; 

a machine^accessible medium having stored thereon executable 
instructions to cause a computer to perform 

checking a virus scan request to determine if scanning is necessary; 

and 

placing the virus scan request on a queue in a priority order based on 
a characteristic of the virus scan request, the characteristic including at least 
one of an identity of the user triggering the virus scan request, a type of the 
process accessing the object, a time stamp of when the virus scan request 
was received, and an indication of a network node accessing the object, 
wherein the virus scan request is prioritized based on at least one of the user 
identity being an administrator as compared to a regular user, the process 
type being an operating system as compared to a user application, the time 
stamp being earlier than the time stamps of each scan request previously 
placed on the queue, and the indication being that the object is accessed from 
a server console as compared to a network client. 

20. (Original) The apparatus of claim 19, farther comprising instructions for 
selecting a one of the virus scan requests from the queue. 

2 1 . (Original) The apparatus of claim 20, wherein the instructions for selecting i$ 
based on the priority order. 

22. (Original) The apparatus of claim 20, wherein the instructions for selecting is 
based on the characteristic of the virus scan request. 

23. (Original) The apparatus of claim 20, further comprising instructions for 
scanning the object of the selected virus scan request. 
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24. (Cancelled) 

25. (Original) The apparatus of claim 20, wherein the instructions for placing the 
virus scan request on the queue in the priority order are further based on 
comparing the characteristic of the virus scan request with the characteristics of 
the virus scan requests previously placed on the queue. 

26. (Original) The apparatus of claim 25, wherein the instructions for placing the 
virus scan request on the queue in the priority order are further based on a 
parameter indicating which of the compared characteristics is given higher 
priority. 

27. (Original) The apparatus of claim 20, wherein the instructions for selecting are 
further based on comparing the characteristics of the virus scan requests placed 
in the queue. 

28. (Original) The apparatus of claim 27, wherein the instructions for selecting are 
further based on comparing the characteristics of the virus scan requests placed 
in the queue with the characteristics of the previously selected virus scan 
requests whose objects are currently being scanned. 

29. (Original) The apparatus of claim 27, wherein the instructions for selecting are 
further based on a parameter indicating which of the compared characteristics is 
given higher priority. 

30. (Cancelled) 

31. (Cancelled) 

32. Cancelled) 

33. (Cancelled) 
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34. (Cancelled) 

35. (Original) The apparatus of claim 19, wherein the instructions for checking to 
determine if scanning i$ necessary include determining when a virus scan status 
indicates the object is not known to be virus free. 

36. (Original) The apparatus of claim 19, wherein the instructions for checking to 
determine if scanning is necessaiy include determining when the object of the 
virus scan request is in a directory not excluded from virus scanning. 

37. (Previously Presented) A virus scanner comprising: 

a pre-processor thread that checks a virus scan request to determine if 
scanning an object of the request is necessary; 

a queue that receives the virus scan request in a priority order based 
on characteristics of the virus scan request, the characteristics including at 
least two of an identity of the user triggering the virus scan request, a type of 
the process accessing the object, a time stamp of when the virus scan request 
was received, and an indication of a network node accessing the object, 
wherein the virus scan request is prioritized based on at least two of the user 
identity being an administrator as compared to a regular user, the process 
type of being an operating system as compared to a user application, the 
time stamp being earlier than the time stamps of each scan request previously 
placed on the queue, and the indication being that the object is accessed from 
a server console as compared to a network client. 

38. (Original) The virus scanner of claim 37, further comprising; 

a scanner thread that selects a one of the virus scan requests from the 

queue. 

39. (Original) The virus scanner of claim 38, wherein the selection is based on the 
priority order. 
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40. (Original) The virus scanner of claim 38, wherein the selection is based on the 
characteristic of the virus scan request. 

41. (Original) The virus scanner of claim 38, wherein the scanner thread further 
scans the object of the selected virus scan request. 

42. (Cancelled) 

43. (Original) The virus scanner of claim 37, wherein the priority order is further 
based on comparing the characteristic of the virus scan request with the 
characteristics of the virus scan requests previously placed on the queue. 

44. (Original) The virus scanner of claim 43, wherein the priority order is further 
based on a parameter indicating which of the compared characteristics is given 
higher priority, 

45. (Original) The virus scanner of claim 40, wherein the selection is further based 
on comparing the characteristics of the virus scan requests placed in the queue, 

46. (Original) The virus scanner of claim 45, wherein the selection is further based 
on comparing the characteristics of the virus scan requests placed in the queue 
with the characteristics of the previously selected virus scan requests whose 
objects are currently being scanned. 

47. (Original) The vims scanner of claim 46, wherein the selection is further based 
on a parameter indicating which of the compared characteristics is given higher 
priority. 

48. (Cancelled) 

49. (Cancelled) 

50. (Cancelled) 
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51. (Cancelled) 

52. (Cancelled) 

53. (Original) The virus scanner of claim 37, wherein determining that scanning is 
necessary includes determining when a virus scan status indicates the object is 
not known to be virus free. 

54. (Original) The virus scanner of claim 37, wherein determining that scanning is 
necessary includes determining when the object of the virus scan request is in a 
directory not excluded from virus scanning. 

55. (Previously Presented) A computer system comprising: 

a processor coupled to a system bus; 
a memory coupled to the processor through the system bus; 
a machine-accessible medium coupled to the processor through the 
system bus; 

a virus scanning process executed from the machine-accessible 
medium by the processor, wherein the virus scanning process causes the 
processor to check a virus scanning request to determine if scanning an 
object of the request is necessary, and if so to further place the checked virus 
scan request on a queue in a priority order based on characteristics of the 
virus scan request, the characteristics including each of an identity of the user 
triggering the virus scan request, a type of the process accessing the object, a 
time stamp of when the virus scan request was received, and an indication of 
a network node accessing the object, wherein the virus scan request is 
prioritized based on the user identity being an administrator as compared to a 
regular user, the process type being an operating system as compared to a 
user application, the time stamp being earlier than the time stamps of each 
scan request previously placed on the queue, and the indication being that the 
object is accessed from a server console as compared to a network client 
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56. (Original) The computer system of claim 55, wherein the virus scanning process 
further causes the processor to select a one of the virus scan requests from the 
queue. 

57. (Original) The computer system of claim 56, wherein the selection is based on 
the priority order. 

58. (Original) The computer system of claim 56, wherein the selection is based on 
the characteristic of the virus scan request. 

59. (Original) The computer system of claim 56, wherein the virus scanning process 
further causes the processor to scan the object of the selected virus scan request. 

60. (Cancelled) 
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IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE APPELLANT 
IN THE APPEAL (37 C.F.R. § 41 .37(c)(1)(h)) 

There is no such evidence. 



-35- 
PAGE 40/41 1 RCVDAT 10114/2005 11:10:13 AM [Eastern Daylight Time] » SVR:USPT0€FXRF4/31 ' DNIS:2738300' CSID:40897146&0* DURATION (miMS):08-18 



OCT. 14. 2005 8:28AM Z I LKA-KOTA8, PC 



NO. 0607 P. 41 



In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 971-2573. For payment of any additional fees due in 
connection with the filing of this paper, the Commissioner is authorized to charge such fees to 
Deposit AccountNo. 50-1351 (Order No. NAI1P360_00.0148.01). 




Zilka-Kotab, P.C. 

P.O. Box 721120 

San Jose, California 95172-1 120 

Telephone: (408)971-2573 

Facsimile: (408)971-4660 
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